CVE-2026-85242

Executive Summary

CVE-2026-85242 is a server-side request forgery (SSRF) vulnerability in PlaywrightCapture, specifically within its favicon retrieval functionality. The product name suggests this is a web service that captures, screenshots, or processes web pages using the Playwright browser automation framework. When the only_global_lookup security option is enabled, the application properly validates the initial favicon URL to block localhost, loopback, and other non-public addresses — but this validation is not applied to HTTP redirects that the underlying aiohttp HTTP client automatically follows.

The practical impact is that an attacker who can influence the content of a page processed by PlaywrightCapture can craft a publicly reachable page whose favicon URL redirects to an internal or restricted address (e.g., 127.0.0.1, localhost, internal network services). Because aiohttp silently follows the redirect, the PlaywrightCapture host will issue HTTP requests to those internal endpoints, enabling SSRF. This could allow probing of internal HTTP services, access to cloud metadata endpoints, or exfiltration of data from otherwise inaccessible internal resources. No CVSS score, EPSS score, PoC, exploit code, or vendor patch has been published, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in the favicon retrieval component of PlaywrightCapture. The application exposes functionality that fetches and/or processes favicon data from URLs derived from user-influenced web content. To enforce network security boundaries, PlaywrightCapture implements a configuration flag only_global_lookup, designed to restrict outbound requests to globally routable (public) IP addresses only. When enabled, the validation logic inspects the initial favicon URL and blocks any that resolve to:

• Localhost (127.0.0.1, ::1, etc.)
• Loopback address ranges
• Link-local addresses (e.g., 169.254.169.254 — cloud metadata)
• Private RFC-1918 address ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

The flaw: The validation is performed once on the original URL but is not re-applied to HTTP redirects. The application uses aiohttp (a Python async HTTP client library). aiohttp automatically follows HTTP redirects (by default, up to 10 consecutive redirects) with no mechanism in PlaywrightCapture to intercept or re-validate intermediate redirect targets.

Attack mechanics:

1. The attacker creates a publicly hosted page (attacker-controlled domain) whose favicon URL points to that same public domain.
2. The attacker configures a handler on their public domain for the favicon endpoint that responds with an HTTP 302/301 redirect to an internal address, e.g., Location: http://127.0.0.1:6379/ or Location: http://metadata.google.internal/computeMetadata/v1/.
3. PlaywrightCapture's only_global_lookup validation passes the initial public URL (since it is publicly reachable), but aiohttp then follows the redirect chain without re-validation.
4. The aiohttp client issues a fresh HTTP request to the redirect target — which may be a restricted internal address.
5. The SSRF request succeeds, and the favicon response data (or the result of the request) becomes available to the downstream processing logic within PlaywrightCapture.

Data exposure: The NVD description notes that impact depends on "how retrieved favicon data is subsequently exposed or processed." If the favicon bytes or HTTP response data are returned to the calling user or written into output files that are retrievable, the attacker can use this as a blind/exfiltrating SSRF channel to read internal service responses.

Root cause classification: CWE-918 (Server-Side Request Forgery). The design flaw is a validation-to-use gap — a classic TOCTOU-style pattern where a security check is applied to the initial request but not to subsequent requests in the redirect chain. The missing piece is a redirect-aware validation middleware that re-applies local-URL restrictions to every hop.

Patch information: The NVD description confirms a patch exists conceptually ("The patch introduces an aiohttp request middleware that applies the existing local-URL validation to every request in the redirect chain"), but no vendor, version, or advisory has been published. Patch confidence is 0/4 — no tracked source has verified a released fix.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-85242. The attack chain below is inferred from the vulnerability class (SSRF via redirect bypass) and the NVD description's technical detail. The scenario assumes PlaywrightCapture is deployed internally (e.g., as a page-screenshot microservice, content-scraping API, or document rendering engine) and that its favicon retrieval feature is triggerable by user-controlled page content.

Attack chain:

1. Reconnaissance / Target identification. The attacker identifies a deployment of PlaywrightCapture — either by discovering an HTTP API endpoint that accepts a target URL to process, or by finding an input vector where user-supplied content (e.g., a URL in a form, an HTML file upload, a message body) is processed and rendered by PlaywrightCapture. The attacker also needs a valid only_global_lookup configuration active (this is the default security posture when the flag is on). The attacker simultaneously maps the internal network (if known) or targets well-known internal endpoints (e.g., http://169.254.169.254/latest/meta-data/ for cloud IAM credentials, http://127.0.0.1:9200/ for Elasticsearch, http://127.0.0.1:6379/ for Redis).

2. Triggering the vulnerable redirect path. The attacker registers a public domain (e.g., evil.example.com) and hosts a page whose HTML includes a <link rel="icon" href="http://evil.example.com/favicon.ico"> tag. The /favicon.ico endpoint on the attacker's server is configured to respond with:

   HTTP/1.1 302 Found
   Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/
   

   The attacker submits this page URL to PlaywrightCapture for processing. If the favicon URL is submitted directly (e.g., as a separate API parameter), the same redirect-returning URL is used.

3. Exploitation — bypass of SSRF filter. The attacker's public URL passes the only_global_lookup validation because evil.example.com resolves to a public IP. PlaywrightCapture invokes aiohttp to fetch the favicon. aiohttp follows the 302 redirect to http://169.254.169.254/... — an address that was never re-validated by the application. The request is issued from the PlaywrightCapture host to cloud metadata. The response body (a JSON list of IAM roles) flows back through the redirect chain into PlaywrightCapture's favicon processing logic as if it were image data.

4. Post-exploitation / impact. If PlaywrightCapture stores or returns raw favicon data (e.g., writes binary response bodies to disk, returns base64 content in API responses, or logs the byte stream), the attacker may retrieve the metadata response. This is the extraction channel. Repeating the process with different internal ports and paths (/latest/meta-data/, http://127.0.0.1:2375/containers/json, http://192.168.1.1/status) allows port scanning of internal services and data retrieval from any HTTP-speaking internal endpoint. In cloud environments, this typically yields temporary IAM credentials, which can be used to pivot into the cloud account. In non-cloud environments, it allows reading internal web dashboards, admin panels, or API endpoints that are not exposed externally.

Weaponized status: None observed. This is a logic-level SSRF bypass that requires no exotic payloads — only public HTTP infrastructure that returns a redirect. Likely trivial to exploit once a PlaywrightCapture instance is found.

Impact Assessment

CVSS scoring: No official CVSS vector or base score has been assigned by the CNA. Without a published vector, risk quantification must rely on the vulnerability class and the NVD description's qualitative details. Based on CWE-918 SSRF scoring precedents, a reasonable estimate would be CVSS 7.5–9.1 (High–Critical), reflecting network attack vector, low attack complexity, no privileges, no user interaction, and potentially high confidentiality impact if regular credentials or internal data are retrievable.

Affected systems: Any deployment of PlaywrightCapture that:

• Runs with the only_global_lookup security flag enabled (ironically, the most locked-down config),
• Processes user-supplied page content or favicon URLs,
• Resides on a network with internal HTTP services or inside a cloud environment with metadata endpoints.

Blast radius:

• Confidentiality: High. Internal HTTP services (admin panels, configuration APIs, monitoring dashboards), cloud metadata IAM credentials, and any resource that speaks HTTP on internal/RFC-1918 addresses are readable.
• Integrity: Low–Medium. SSRF is primarily a read/probe primitive; however, some internal APIs (e.g., network-attached storage admin, container orchestrator APIs, self-registration endpoints) allow state-changing POST/PUT requests if the SSRF channel can be used to drive them.
• Availability: Low. Degraded availability is only relevant if the internal endpoint's response can cause resource exhaustion or if the SSRF is used to reach shutdown/restart APIs.

Lateral movement potential: High in segmented networks where PlaywrightCapture serves as a bridge from the internet-reachable application tier into an otherwise isolated internal segment.

CISA KEV status: Not listed — no known in-the-wild exploitation. EPSS status: Not yet scored by FIRST.

Detection Guidance

Detection must focus on anomalous outbound HTTP request patterns originating from PlaywrightCapture host(s), because the SSRF manifests as internal requests following an external redirect. No public exploit signatures exist, so rule signatures target the behavioral pattern.

Sigma Rule

title: PlaywrightCapture SSRF Redirect Bypass - Outbound to Restricted Addresses
id: 0e3c6a1b-8f9e-4c2b-a7d5-3f9c1b8e2d4a
status: experimental
description: Detects outbound HTTP requests from PlaywrightCapture to restricted/local addresses that may indicate SSRF via redirect chain bypass (CVE-2026-85242). Applies to web proxy / process monitoring logs.
author: Valtersit Threat Intel
date: 2026/02/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_playwright:
        Image|endswith:
            - '/playwrightcapture'
            - '/python'
        CommandLine|contains:
            - 'favicon'
            - 'playwright'
            - 'only_global_lookup'
    selection_network:
        # Detect attempts to reach restricted destinations via aiohttp client
        # Equivalent surrogate: process network connections destined to local/private ranges
        DestinationIp|startswith:
            - '127.'
            - 'localhost'
            - '10.'
            - '192.168.'
            - '169.254.'
        DestinationPort:
            - 80
            - 443
            - 8000
            - 8080
    condition: selection_playwright and selection_network
level: high
falsepositives:
    - Legitimate internal favicon caching if host policy intentionally fetches local resources
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.85242
    - cwe.918

YARA Rule

rule CVE_2026_85242_PlaywrightCapture_SSRF_RedirectBypass
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects source code or configuration referencing PlaywrightCapture favicon SSRF or aiohttp redirect-following patterns associated with CVE-2026-85242. Targets Python application source, Dockerfiles, and config artifacts."
        cve = "CVE-2026-85242"
        cwe = "CWE-918"
        date = "2026-02-15"
        score = 60

    strings:
        // NVD-described identifiers (from description text only)
        $class_name_core = "PlaywrightCapture"
        $option_flag = "only_global_lookup"
        $http_lib = "aiohttp"
        $redirect_pattern = "redirect"
        $favicon = "favicon"

        // code-level pattern indicative of validation applied only to initial URL
        $initial_only_1 = /only_global_lookup.*(localhost|loopback|127\.0\.0\.1)/ nocase
        $initial_only_2 = /validate.*url.*only_global_lookup/ nocase
        $no_redirect_recheck = /aiohttp.*(follow_redirects|allow_redirects).*=\s*True/ nocase

    condition:
        uint16(0) == 0x5A5A or
        (
            filesize < 2MB and
            (1 of ($class_name_core, $option_flag, $http_lib, $favicon)) and
            (1 of ($initial_only_1, $initial_only_2, $no_redirect_recheck))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-85242 PlaywrightCapture SSRF Redirect Bypass — outbound redirects to restricted/localhost addresses"; flow:to_server,established; content:"Location:"; http_header; content:!"localhost"; http_header; content:!"127.0.0.1"; http_header; content:"302"; http_server; http.protocol; http.response_body; threshold:type both, track by_src, count 3, seconds 300; classtype:attempted-recon; sid:2026085242; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-85242, cwe CWE-918, mitre_tactic TA0007, mitre_technique T1090;)

Elastic Detection

// Correlate inbound HTTP 3xx responses from public origins with subsequent outbound connections to restricted address ranges
sequence by process.entity_id with maxspan=10s
  [network where process.name : "*playwright*" and
     network.direction : "egress" and
     destination.ip : "127.0.0.1" or destination.ip : "10.0.0.0/8" or
     destination.ip : "172.16.0.0/12" or destination.ip : "192.168.0.0/16" or
     destination.ip : "169.254.169.254"]
  [http where process.name : "*playwright*" and
     http.request.method : "GET" and
     url.path : "*favicon*"]

Splunk SPL Query

index=stream OR index=iis OR index=proxy sourcetype=* (src_ip IN ("127.*","10.*","192.168.*","169.254.*")) OR (dest_host="localhost")
| where like(url_path,"%favicon%") OR like(http_referrer,"%favicon%")
| lookup cve_lookup cve_id as cve OUTPUT cve_desc | where cve="CVE-2026-85242"
| stats count min(_time) max(_time) by src_ip, src_host, dest_ip, dest_host, url_path, status_code, user_agent
| sort - count
| table _time src_ip dest_ip dest_host url_path status_code user_agent count
| rename src_ip as "Source IP", dest_ip as "Destination IP", dest_host as "Destination Host", url_path as "Requested URL", status_code as "HTTP Status", count as "Request Count"
| where not (dest_host LIKE "%.%") or (dest_host IN ("localhost", "ip6-localhost", "metadata.google.internal"))

Wazuh OSSEC Rule

<group name="playwrightcapture, ssrf,">
  <rule id="100852" level="12">
    <decodedate></decodedate>
    <match>127.0.0.1:80|localhost:80|169.254.169.254|10.0.0.0/8|192.168.</match>
    <description>CVE-2026-85242 PlaywrightCapture SSRF redirect to local/restricted address detected - outbound HTTP to internal network.</description>
    <group>attacker_ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100853" level="6">
    <if_sid>100852</if_sid>
    <decodedate></decodedate>
    <match>favicon</match>
    <description>CVE-2026-85242 PlaywrightCapture favicon request associated with SSRF redirect - verify internal resource access.</description>
    <group>attacker_ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor advisory, version-specific fix, or patch artifact has been published in any tracked advisory source. The NVD description indicates the conceptual fix (an aiohttp request middleware that re-validates URLs in the redirect chain), but no release containing it has been identified.

Suggested immediate mitigations:

1. Disable or restrict favicon retrieval. If favicon fetching is not a critical business function, disable it via playrightCapture configuration or remove/disable the code path that fetches favicon URLs from user-controlled content. This eliminates the attack surface entirely.
2. Network egress restriction. Apply strict egress firewall rules on the PlaywrightCapture host(s) to block outbound TCP connections to RFC-1918 address space, link-local addressing (169.254.0.0/16), loopback, and the cloud metadata IP (169.254.169.254). This prevents the SSRF from reaching internal services even when the redirect bypass logic fails.
3. Upstream proxy mandate. Force aiohttp traffic through an outbound HTTP/HTTPS forwarding proxy that enforces its own URL allow/deny policy.
4. Defense in depth — isolation. Place PlaywrightCapture hosts in a dedicated DMZ or microsegmented zone with no route to internal services, databases, or admin panels.

Patch/upgrade steps: Monitor the vendor's release channel (the source/issue tracker where PlaywrightCapture is distributed). Update to a version that includes the "aiohttp request middleware" described in the NVD entry. If a fork or patched artifact exists, apply it after source review. Continue checking NVD, GitHub advisories, and the vendor security page for an official advisory.

Long-term hardening:

1. Implement SSRF protection at the application layer using allowlist-based domain resolution, prohibiting IP literals, DNS rebinding protection, and re-validation of each redirect hop.
2. Apply network policy as code (e.g., Kubernetes NetworkPolicy, cloud security groups) at the service level to enforce least-privilege egress.
3. Add SSRF regression tests to the CI/CD pipeline — test cases should include redirect chains returning Location headers that point to localhost, RFC-1918 ranges, and cloud metadata.
4. Harden all internal management services with authentication and network ACLs so that even if SSRF recurs, the reachable endpoints do not expose credential material.
5. Treat all favicon/content-fetching microservices as untrusted network ingress points; require outbound traffic to go through security-enforced proxies.

References

1. NVD Entry — CVE-2026-85242: https://nvd.nist.gov/vuln/detail/CVE-2026-85242 (CVE record and description reference)
2. MITRE CWE-918 Server-Side Request Forgery — https://cwe.mitre.org/data/definitions/918.html (vulnerability class reference)
3. aiohttp Client Documentation — automatic redirects behavior (server-side reference for flaw mechanism): https://docs.aiohttp.org/en/stable/client_quickstart.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85242 not listed — verify at): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST.org EPSS feed (CVE-2026-85242 not yet scored): https://www.first.org/epss/data_stats

Threat actor activity: No known threat groups, campaigns, or exploit-in-the-wild evidence associated with CVE-2026-85242 as of this report date.